LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   Does anyone know of a user level based file integrity checker? (https://www.linuxquestions.org/questions/linux-software-2/does-anyone-know-of-a-user-level-based-file-integrity-checker-645482/)

abefroman 05-28-2008 09:59 PM

Does anyone know of a user level based file integrity checker?
 
Does anyone know of a user level based file integrity checker?

(One I can install if I don't have root access, to check the files in my user directory and subdirectories thereof).

GrapefruiTgirl 05-28-2008 10:15 PM

Do you mean 'integrity' as in like for rootkits, viruses, and that sort of thing?

Far as I know, you could build & use 'RKhunter' or 'chkrootkit' without root installation privileges, but hopefully (probably ;)) someone will correct me quickly if I am mistaken. You would need to alter their default configuration and/or search paths, but I think that can be done.
As for viruses, I won't attempt to suggest anything, because I don't use anything.

If it is something totally NOT along these lines that you are seeking, please clarify.

Sasha

PS - if this IS the stuff you seek, then you might suggest these tools to your server admin, for root installation, though I would like to think that any respectable server admin/host has tools of this sort in place already... Then again, who knows :/

chrism01 05-29-2008 12:06 AM

Re GrapefruiTgirl's tip, see also Tripwire.

If you just mean accidental corruption (transmission/bad disk write) etc, md5 checksum works for most people eg Distros usually offer this so you can check their downloads.

abefroman 05-29-2008 08:16 AM

Quote:

Originally Posted by chrism01 (Post 3167758)
Re GrapefruiTgirl's tip, see also Tripwire.

If you just mean accidental corruption (transmission/bad disk write) etc, md5 checksum works for most people eg Distros usually offer this so you can check their downloads.

Will tripwire work at the user level? And can their be multiple copies of it installed?

kummiliim 05-29-2008 08:46 AM

Use AIDE which is a replacement for tripwire. I can't see why you would need separate copies but yeah, sure, why not.

Edit: And yes, of course it's in userspace.

anomie 05-29-2008 08:53 AM

Quote:

Originally Posted by abefroman
Does anyone know of a user level based file integrity checker?

Right -- there is nothing to install. Using md5sum + sha1sum should verify a file's integrity. You can use both as a regular user.

Contrived example (on a FreeBSD box, with slightly different command implementations):
Code:

> find sandbox | xargs sha1
SHA1 (sandbox) = 34ab74e88e611127ade407ca3706d7dae5cfa266
SHA1 (sandbox/blah1) = 55ca6286e3e4f4fba5d0448333fa99fc5a404a73
SHA1 (sandbox/blah2) = 6132b58967cf1ebc05062492c17145e5ee9f82a8

> find sandbox | xargs md5
MD5 (sandbox) = a4ef5fb92afba44310df7cd9bb8309ad
MD5 (sandbox/blah1) = 764efa883dda1e11db47671c4a3bbd9e
MD5 (sandbox/blah2) = 90580754da3ed1b3e4be38c9b277bc9b

(On FreeBSD there is also the useful mtree program, but I'd guess that will not apply here.)

You could put together a little script that will capture this information, and another script to compare it with a previous run. Or you could search the net for a solution that someone else already created.


All times are GMT -5. The time now is 04:06 PM.